salla-app-auth
Pass
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill documentation (SKILL.md) and reference files (e.g., references/app-events.md, references/token-refresh.md) focus on teaching best practices for secure Salla API integration. It explicitly warns against insecure practices like storing tokens in /tmp or in-memory variables on serverless environments.
- [SAFE]: External URLs and resources identified, such as those pointing to accounts.salla.sa, api.salla.dev, and official GitHub repositories (e.g., SallaApp/oauth2-merchant), belong to the official vendor and are used for legitimate authentication and documentation purposes.
- [SAFE]: The code snippets provided for token handling and refresh include necessary security controls, such as distributed locking to prevent token race conditions and explicit validation of webhook payload structures.
- [SAFE]: No evidence of prompt injection, obfuscation, or unauthorized data exfiltration was found. Placeholder credentials (e.g., YOUR_CLIENT_SECRET) are used appropriately in examples.
Audit Metadata